~/.claude config directory silently wiped and recreated - 4 incidents, matches #41415/#34330 pattern

Summary

~/.claude (native Windows install) has been deleted and recreated wholesale four times since late August, most recently twice within ~2 hours of each other. Each time: the folder's own CreationTime changes (full delete+recreate, not content edits), .claude.json gets regenerated blank, prompt history and transcripts zero out, and settings.json reverts to a stub missing most hooks. This has cost hours of manual recovery each time and, on the most recent occurrence, happened mid-session while actively working in the window — the chat simply vanished and the folder was found empty moments later.

This looks like the same bug class reported in #41415 and #34330 (Claude Code's own background process deleting its own config subdirectories), not something external — see the audit below.

Environment

• OS: Windows 11 Pro
• Install: native (~/.local/bin/claude), auto-update channel
• Version at time of most recent incidents: 2.1.269 (updated cleanly from 2.1.268 the evening before, per .last-update-result.json — no update ran at the actual incident times)

Incident timeline

| # | When | Scope | Recovered from |
|---|---|---|---|
| 1 | ~2026-08-25/26 | ~3,572 transcripts, skills, plugins, hooks | A Windows shadow copy that happened to exist |
| 2 | ~2026-09-08 | Entire folder | Manual copy salvaged beforehand |
| 3 | 2026-09-12 07:29:35 | 7,462 transcripts, full config | Shadow copy from the night before + a 30-minute incremental backup script written after incident #1 |
| 4 | 2026-09-12 ~09:28 (within ~2h of incident 3's recovery finishing) | Entire folder again, including secrets/ (a subfolder of unrelated local API tokens, 19 files) — this went unnoticed at first because transcript count alone looked fully restored | Same incremental backup, plus a full-tree diff against the backup that caught the missing subfolder |

What I ruled out on my end

• No scheduled task fired in the incident window (checked full task list, not just name-matching)
• No antivirus/cloud-sync client (OneDrive, Google Drive File Stream) has ~/.claude in its sync scope
• No suspicious startup entries
• Windows auto-update of Claude Code itself completed hours before the incident, not at the exact time
• A ~/.claude/backups/ folder containing .claude.json.backup.<timestamp> files appeared after one incident — this looks like it's written by Claude Code itself (not anything of mine), suggesting there's already an internal config-repair/backup mechanism whose behavior around a full wipe+recreate is worth checking.

Related issues

This looks like the same underlying bug as:

• #41415 — ~/.claude/agents/ silently emptied twice by Claude Code's own background process; reporter's filesystem trace showed the CLI's own node process doing the delete; theorized cause was "a cloud-agent sync path that clears the local directory instead of merging into it." Closed not planned, no root cause published.
• #34330 — .claude/skills/ actively watched and deleted by the CLI process within ~300ms of file creation (v2.1.76). Closed as duplicate.
• #70052, #54092 — transcripts vanishing from .claude/projects/.

Given four independent occurrences on my machine over ~3 weeks, with nothing external implicated after two separate rounds of auditing, I'd really appreciate this getting an actual root-cause investigation rather than another "closed, not planned." A repeatedly-wiped config directory that contains credentials, session history and months of accumulated project context is a serious reliability and trust problem, not a cosmetic one — this is now the fourth time I've had to do disaster recovery on my own tooling's home directory, and each time there's no indication of what actually happened or why. Across the four incidents this has already cost me multiple hours of manual recovery work, plus real token/usage spend re-running diagnosis and restore sessions each time — this is not a free or trivial thing to keep happening. I'll be honest: at this point I'm genuinely frustrated. This is my working environment, and having its config directory disappear out from under me for the fourth time, mid-session, with zero explanation, is a bad experience regardless of how the fix eventually lands.

What would help

• Confirmation of whether there's an internal cloud-sync/repair mechanism that can, under some condition, clear ~/.claude instead of merging into it (matching the #41415 theory)
• Any telemetry/logging Anthropic has server-side that could correlate with these timestamps if I provide them privately